The invention relates to a method and a circuit arrangement for monitoring the operation of a processor, particularly a hardware watchdog circuit in a motor vehicle.
Patent specification DE 43 29 872 C2 discloses a monitoring circuit for microprocessors, where a monitoring circuit for the processor to be monitored is regularly reset by means of a trigger signal during normal operation. If the processor is in a current saving mode, the monitoring unit sends an interrupt signal to the processor. If the processor does not react to this interrupt signal on account of an error, the monitoring circuit produces a reset pulse.
A known device (DE 32 43 760 C2) for monitoring the operation of a processor comprises a counter with a separate clock oscillator. The counter has a reset input which is reset by a reset signal transmitted by the monitored processor at cyclic intervals of time. If the reset signal is absent, the counter outputs a “graduated reaction” depending on the period of time for which a signal is absent, i.e. initially a signal is transmitted which sets a software interrupt. If this does not result in the program being restarted, a signal triggering a hardware reset on the processor is sent after a pre-set period of time. This restarts the processor, as after the power supply is switched on. If the processor continues to send no reset signal to the counter, the processor is deactivated and/or an alarm is triggered in a third and final stage.
A drawback of the known device is that the processor respectively receives only one request signal to set a software interrupt and to perform a hardware reset. If the processor is not able to perform a restart at this time on account of a temporary disturbance, the system remains inactive and the processor needs to be isolated from the power supply in order to be reinitialized.
Such a temporary disturbance can be triggered by an electromagnetic disturbance signal, for example. When the disturbance has decayed, the processor would restart without any difficulty following a fresh hardware reset signal. In the case of the known device, however, no further hardware reset signal is forthcoming at this point, and the processor remains inactive.
Secondly, the nonmaskable interrupt preferred for the known device does not permit the processor to be operated in a current saving mode. The processor would need to reset the counter before the first, usually brief period of time has elapsed, otherwise the processor would be “woken up” again by the setting of the software interrupt. Consequently, only a minimal current saving is obtained.